SPACE SHUTTLE DIGITAL FLIGHT CONTROL SYSTEM 


Glenn M . Minott and John B . Peller 
Rockwell International Corporation 

and 

Kenneth J . Cox 
NASA Johnson Space Center 


SUMMARY 


The Space Shuttle digital, fly-by-wlre, flight control system (FCS) 
presents an Interesting challenge In avionics system design. In residence 
in each of four redundant general purpose computers (GPC*s) at lift-off are 
the guidance, navigation, and control algorithms for the entire flight. 

(A fifth GPC hotises a backup FCS.) The mission is divided into several 
flight segments: first-stage ascent, second-stage ascent; abort to launch 

site, abort once around; on-orbit operations, entry, terminal area energy 
management (TAEM) ; and approach and landing. The FCS is complicated in that 
it must perform the functions to fly the Shuttle as a boost vehicle, as a 
spacecraft, as a reentry vehicle, and as a conventional aircraft. The crew 
is provided with both manual and automatic modes of operations in all flight 
phases including touchdown and rollout. 


INTRODUCTION 


The Shuttle vehicle configuration is shown in Figure 1. It consists of 
the orblter vehicle, the orblter external tank (ET), and two solid rocket 
boosters (SRB’s). During Shuttle ascent, control authority is provided by 
thrust vector control (TVC) of the three orbiter main engines and each of 
the two SRB's. Orbit insertion and on-orbit control are accomplished by 
combinations of 46 reaction control jets plus two gimbaled orbit maneuvering 
engines (orbit maneuvering system or OMS) . A blend of reaction control 
system (RCS) Jets and the aerosurfaces is used during entry; all aerosurface 
control is used during TAEM and approach and landing. The aerosurfaces 
(Figure 2) include the elevens, used in unison for pitch control and differ- 
entially for roll control; rudder panels, used in unison for rudder control 
and differentially as a speed brake; and a body flap. Primarily the body 
flap protects the main engines from entry heating. However, it also supple- 
ments the elevens for pitch trim. 

The orbiter is a first step in design of a control-configured vehicle. 
It is statically unstable in both pitch and yaw over a large percentage of 
the flight envelope (up to 2 and 1/2 percent of the body length in pitch) . 
This design philosophy has permitted extensive weight (and hence cost) 
savings because it has allowed wing, tail, and aerosurface sizes to be 
minimized. 
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DESCRIPTION OF THE SPACE SHUTTLE FLIGHT CONTROL PROBLEM 


During Shuttle mated ascent, the PCS consists of a three-axis attitude 
command system (Figures 3 through 5) . Five seconds after lift-off, commands 
are issued to accomplish the .pitch-over and roll-to-flight-azimuth maneuvers. 
During regions of high dynamic pressure, a load relief system in both pitch 
and yaw minimizes air loads on the vehicle. The system is optimized with 
respect to weight savings (due to load reductions) versus weight penalties 
(due to added propellant caused by flight path dispersions arising from the 
use of the load relief system) . The load relief function is accomplished 
by lateral and normal accelerometer feedbacks blended into the attitude com- 
mand system starting at 25 seconds into the flight. After the region of high 
dynamic pressure passes, the load relief function is blended out (95 seconds) . 
The guidance system commands an open loop pitch program versus time. The 
trajectory is shaped to minimize glmbal angle requirements and to balance 
the weight penalties associated with positive and negative air loads due to 
winds and gusts. 

During SRB tail-off, which is sensed as an acceleration decay, the sys- 
tem is commanded to fly a pitch program versus time for proper SRB separation 
conditions. At staging, the control system is switched to the second-stage 
mechanization, which is a standard three-axis attitude command system 
(Figure 6) . At a given time, which corresponds to a predicted dynamic 
pressure of 25 psf, the guidance loop is closed, and a form of linear tangent 
steering is used to guide the vehicle to the orbit insertion point. In 
addition to the automatic modes described, an augmented manual capability is 
provided in both first and second stages of flight. 

The abort modes are not discussed in this paper. 

In the on-orbit flight phase the crew is provided with the 13 manual and 
automatic control modes listed in Table 1. Two gimbaled, 6000-pound- thrust 
(OMS) engines are used for large delta-V maneuvers. Various combinations of 
forty 900-pound- thrust reaction jets are used for attitude control and small 
delta-V translation maneuvers. In addition, six 25-pound-thrust RCS jets 
are provided for high accuracy vehicle pointing. The jet select logic pro- 
vides attitude and translational capability with less than 7 and 1/2 percent 
cross coupling into adjacent axes. The number of jets is predicated upop 
the requirement for a fail operational, fail safe capability throughout a 
mission. 

The entry flight control system (Figures 7 through 9) is a blend of 
RCS and aerosurface control effectors. During the early portions of entry 
an all-RCS control system is used (Figure 10). When a dynamic pressure of 
2 psf is reached (sensed from vehicle accelerations), the elevons are acti- 
vated to provide a pitch and roll trim supplement to the RCS system. When a 
dynamic pressure of 10 psf is reached, the elevons provide sufficient 
authority for roll control, and the roll jets are Inhibited. When a dynamic 
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Table 1. On-Orbit Control Modes 


Mode 

Manual direct rotation acceleration command 
Manual direct translation acceleration command 
Manual direct translation pulse command 
Manual direct rotation pulse command 

Three-axis manual proportional rate command augmentation 

Manual RCS rotation discrete rate command augmentation 

Three-axis attitude hold mode 

Three-axis automatic attitude command 

Automatic RCS local-vertical barbecue attitude command 

Three-axis automatic inertial barbecue command 

Two-axis aptomatic RCS translation command 

Automatic OMS thrust-vector control 

Manual OMS thrust vector control command augmentation 


pressure of 20 psf is reached, the pitch jets are inhibited, the yaw jets 
being retained for yaw stabilization and control. During the majority of 
entry the vehicle is statically unstable in yaw. However, the stick-fixed 
dutch roll mode is dynamically stable. The control system takes advantage of 
this stability in that the vehicle is permitted to oscillate within course 
dead bands in roll and yaw, thus avoiding an excess usage of RCS for yaw 
stabilization. 

The heating rates and total heating load to the vehicle are minimized 
by flying the high-speed portion of entry (down to 8000 feet per second) at 
high angles of attack (approximately 30 degrees) . At Mach 8, an angle-of- 
attack transition is initiated, ending at an angle of attack of approximately 
10 degrees (roughly the maximvun lift-to-drag condition) and a velocity of 
approximately 1500 feet per second. During this transition, the vertical 
tail and rudder become effective. At an angle of attack of 18 degrees 
(Mach 5) the rudder control is activated. By the time the vehicle reaches an 
angle of attack of 10 degrees the rudder is fully effective, and the yaw jets 
are thereafter inhibited. The FCS is switched to conventional aircraft con- 
trol mode for the TAEM phase of flight. Manual and automatic modes during 
entry are similar, the only difference being the substitution of a guidance 
steering command in the auto system instead of the rotation hand controller 
output in the manual system. 

The TAEM flight phase is initiated at a velocity of about '1500 feet per 
second during entry with a corresponding altitude of approximately 70,000 feet. 
This flight phase extends to the approach and landing interface at approxi- 
mately 10,000 feet. During this period, the guidance system issues commands 
to control the dynamic pressure and energy state of the vehicle and to 
provide steering commands to arrive at the approach and landing interface in 
alignment with the runway (Figure 11) . Three basic control modes are 
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provided to the crew; manual direct (MD) , control stick steering (CSS) , and 
automatic. The manual direct mode (Figures 12 through 14) is strictly a 
backup in which no augmentation is used (i.e., all feedback loops are open). 

When the crew selects control stick steering, the basic mode of operation 
becomes a command augmentation system (CAS). It is implemented as ati Ng com- 
mand (normal load factor) mechanization in pitch (yaw is similar) , and roll 
rate is commanded into the roll channel (Figures 15 through 19) , Two submodes 
to CSS are available. One is attitude hold in pitch and/or roll (Figures 20 
and 21). When the stick is out of detent, the CAS mode is operational; when 
the Stick is returned to detent, the attitude function is initiated at the 
attitude existing at the time the stick was returned to detent, A second sub- 
mode to CSS is an indicated air speed (IAS) hold (Figure 22). In this mode, 
the speed brakes are commanded to maintain the air speed commanded by the 
crew. When the IAS is not selected, speed brake control is a manual function. 

In the auto-TAEM mode, Ng commands are issued from the guidance system 
to the pitch and yaw channel, and roll commands are issued to the roll 
channel. This is shown in Figure 23 for the pitch axis. 

After the vehicle exits blackout during entry, a TACAN (tactical air 
navigation) navigation aid is acquired by the communication system for navi- 
gation update. The guidance system steers the vehicle to intercept a heading 
alignment circle to bring the vehicle to the approach and landing interface. 

As the vehicle rounds the heading alignment circle (Figure 24) , its orienta- 
tion becomes such that the antennas capture a microwave scan beam landing 
system (MSBLS) navigation aid. This will occur at an altitude of roughly 
14,000 feet. When lock-on is verified, the flight phase switches from TAEM 
to the approach and landing. The same three basic modes are available to the 
crew as discussed for TAEM (i.e., manual direct, CSS, and auto). The manual 
direct and CSS modes are as described for the TAEM phase. In the autoland 
mode (Figure 18) , the guidance system issues attitude commands to the vehicle 
to fly down a steep glide slope, which varies from 21 to 24 degrees depending 
upon the payload weight (Figure 25) . The speed brakes are modulated to hold 
an air speed of 290 knots. At an altitude of 1800 to 2000 feet, depending 
on payload weight, a preflare maneuver is commanded to bring the vehicle 
exponentially to a 3-degree glide slope. A final flare is commanded at 
approximately 200 feet altitude, and the vehicle nominally lands with a sink 
rate of about 2 and 1/2 feet per second and about 4000 feet down the runway. 
When main gear touchdown is detected (by a squat switch), the normal and 
lateral acceleration feedbacks (in CSS) and Integrator loops (in auto) are 
opened, and a pitchdown command is issued. Roll commands are driven to zero. 
Lateral steering is initially accomplished with the rudder. After the nose 
gear slapdown has been verified, and after the velocity is reduced to approxi- 
mately 110 knots, nose wheel steering is engaged. The rest of the rollout is 
, accomplished with the rudder and nose wheel steering. The autoland function 
is totally automatic with the exception of gear extension (h = 500 ft) and 
runway braking, which are done manually. 
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DESCRIPTION OF THE SPACE SHUTTLE FLIGHT CONTROL SYSTEM MECHANIZATION 


The flight control problem just described is essentially controlling a 
large number of quite different flight phases, some of which include unstable 
vehicle dynamics. Thus, flight control is a flight safety-critical function 
that must have great flexibility. The concept chosen for flight control is 
an all-digital, fly-by-wire implementation that uses several general-purpose 
computers connected by serial digital data buses to remotely located multi- 
plexer/demultiplexer units (MDM's). The MDM’s in turn, are connected to the 
fli^t control sensors, effectors, and controls. The guidance and navigation 
problems are solved by this same mechanization (with the appropriate addi- 
tional sensors) . It is used for all flight phases and elements , including 
control of the SRB’s during ascent. The block diagram of this configuration 
is shown in Figure 26. 

Efficiency of presentation requires that the computer complex be 
described first, including the MDM’s and data buses. Then the operating 
configuration of the flight control equipment will be described. 

Figure 27 illustrates the internal configuration of the computer and 
associated elements of the central digital elements (collectively denoted as 
the digital processing subsystem or DPS) . At the core of the DPS are five 
general purpose computers. Each GPC is a modified IBM AP-101 central proc- 
essor unit and core memory with a special input/output processor (lOP) that 
Interfaces with 27 serial digital data buses. The memory contains 64,000 
32-bit words with a nominal one-microsecond cycle time. The lOP contains a 
master sequencer and 27 data bus conttol elements. Under overall control of 
the master sequencer, each data bus control element has the capability to 
send and receive data over its particular data bus. In addition to data, the 
transmittals Include commands to other equipment connected to the bus. In 
addition to the ability to request and subsequently receive data on the bus, 
each data bus control element caii monitor data on the bus resulting from 
other data bus control elements (associated with other GPC’s). This monitor- 
ing capability is fundamental to the processing of flight control sensor 
data, as will be described. 

Of all the data buses, those central to this discussion are the eight 
dedicated to guidance, navigation, and flight control and the five inter- 
computer data buses. Each of these buses is connected to all of the GPC’s. 
Also, those eight buses dedicated to the guidance, navigation, and flight 
control functions are connected to four MDM’s located in the forward end of 
the vehicle, another four located in the aft end of the vehicle, and various 
devices to Interface with controls, displays, event controllers, and the main 
engines. Each flight control sensor and effector is connected to one of the 
aforementioned eight MDM’s, and communication between all flight control 
elements is via these buses. 

Data transmittal over this bus network is by time division multiplex 
techniques at a one-megabit data rate; each word is 28 bits with the first 
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three bits used for synchronization and distinguishing between comiaand and 
data formats. The next five bits identify the address of the word destina- 
tion or source, as appropriate. The rest of the word is devoted to command 
or data information, except for the last bit, which is a parity bit. Each bus 
operates in a half-duplex mode. 

The function of each MDM is to interface between the serial data streams 
on the bus and the several elements connected to it. The interfaces between 
the MDM and the several elements may be analog, digital, or discrete and 
may generally be in either direction. Several hundred elements can typically 
be connected to the MDM, the exact number being dependent upon the specific 
mix of analog, digital, and discrete interfaces. 

Data for use in a GPC are obtained by a request (under GPG software 
control) being issued through the lOP, over a data bus, to a specific MDM 
(or other interfacing element), and then to the particular device. The reply 
(usually data) follows the reverse path. Because of the monitoring capability 
of each data bus control element, each GPC can receive the data, even though 
only one requested it. This feature is used to advantage in the flight con- 
trol system, as will be described, The intercomputer buses are used for 
exchange of data between GPG's. 

The five computers are synchronized only at each minor cycle (40 milli- 
seconds) and are then only synchronized close enough to ensure "sequence 
synchronization" between machines; l.e., all machines are on the same minor 
cycle except for a small interval near the beginning or end of a minor cycle. 

With this summary description of the central digital processing sub- 
system, it is now possible to describe the mechanization of the flight control 
system. The system uses both rate gyros and lateral accelerometers as basic 
stabilization sensors; inertial measuring unit (IMU) glmbal data are used for 
certain attitude hold and attitude command modes. Three sets of rate gyros 

are used, two on the SRB's and one set on the orbiter. Each set consists of 

three axes, and each axis is triply redundant. There are two sets of lateral 
accelerometers, one foirward and one aft on the orbiter. Each set senses the 
two axes orthogonal to the vehicle roll axis, and each axis is triply redun- 
dant. , Each redundant instrument in a set is connected to a different MDM. 
Gontrols are generally triply redundant within each set, and most controls 
are duplicated between the left and right seats in the cockpit. 

The effectors vary for each flight phase. Of primary concern are the 
effectors used during the so-called "critical flight phases," those during 
which a hard-over failure of an axis would lead to vehicle loss before the 
fault could be rectified by crew actions. Most of the nonorbital portions 
of flight, both ascent and return, fall into this category. The flight 

control system must be designed to tolerate any two failures and still 

permit safe vehicle and crew recovery. The flight control effectors used 
during these flight periods have multiple input ports at the hydraulic 
secondary-valve level. These multiple inputs are normally used in a force- 
fight mode. The multiple inputs are also compared, and any deviation of 
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one input from the others of a specified amount for a specified time results 
in that input channel being "kicked out" by the actuator itself. These 
"pseudo- VO ting" actuators protect against two different input failures. Upon 
occurrence of a first failure, the action is the same for both the ascent and 
return flight phases: the bad channel is removed, and operation continues 

with the remaining channels. Upon occurrence of a second failure, the 
response varies according to the flight phase. The thrust vector control 
actuators used during ascent have only three input ports, and, upon occur- 
rence of a second failure, the actuator simply centers that axis on that 
engine. Because there are multiple thrusters (three orbiter main engines and 
two SRB’s), loss of thrust vector control in one axis is not flight critical. 
The mission can continue after the loss of thrust vector control from one 
axis. During the return portions of flight, things are different. There is 
essentially only one of each basic flight control surface, and centering of 
a surface would generally lead to loss of the vehicle. Consequently, the 
flight control effectors during these portions of flight have four input 
channels. After the first failure, operation Continues with the remaining 
three. After failure of the second, failure detection and isolation of the 
bad input channel is easily detected by conventional comparison techniques, 
and operation continues with the remaining two channels. 

During these critical flight phases, the flight control system is 
configured as shown in Figure 28. At the beginning of each flight control 
computational cycle (denoted as a minor cycle and equal to 40 milliseconds) , 
the itb GPC requests data from the ith sensor. Because the Involved data 
buses are connected to all GPC Vs, each GPC receives the data from the ibb 
sensor, either directly (in the case of the ith gpC) or via the monitoring 
capabilities of the other GPC's. GPC’s 1 through 3 are involved in data 
requests; GPC’s receive data nominally only through the monitoring of bus 
traffic, but can assume the data request function of a failed GPC. The result 
is that all GPC's have all of the sensor data. 

Each computer selects a single set of data for use in the flight control 
computations. Until an instrument failure is detected, the computer simply 
selects the middle value of the three data valiies for each measurement. Upon 
detection and isolation of an instrument failure (by combined hardware and 
software tests), the computer simply averages the data from the remaining 
two instruments. Upon detection and isolation of a second failure (again by 
a combination of hardware and software tests) , the computer uses the data 
from the remaining good sensors. Since all computers have the same input 
data and use the same data selection algorithms, all computers use the same 
specific sensed values in the flight control computations. 

On the downstream side of the computer, each computer is assigned to a 
specific input port of each flight control effector. Thus, if a computer 
should fail, the effect at the system level is simply a small transient 
because of the momentary incorrect force fight within the actuator. If such 
a failure occurs during ascent, GPC 4 assumes the role of the failed machine, 
and the failure tolerance of the system is returned to the same as it had at 
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launch. During entry through landing, four machines are nominally connected 
to the four input ports of each control effector. However, during these 
return phases, no GPC is brought in to replace a failed machine, since the 
ability to tolerate two failures exists without such replacement. 

Because all GFC’s are connected to all buses, and thus to all MDM's, It 
would be possible to operate the flight control equipment in a "master-slave" 
configuration; that is, one GPC would command all actuator ports until detec- 
tion of its failure, at which time another GPC would assume conunand. This 
concept was rejected because of difficulty in proving that the master GPC 
would be made to relinquish control in all possible failure conditions. 

A difficulty of operating flight control equipment in the parallel 
string configuration just described is possible divergence between the 
parallel control channels. This problem manifests itself by the commanded 
control signal from each computer differing from those issued by other com- 
puters by ever increasing amounts. In the Shuttle configuration, this would 
quickly cause various control channels to "kick out," even though no failures 
had occurred. The problem is caused by "noise" getting into the control 
channel that contains Integrators. The nplse can be from traditional ampli- 
tude variations (which could result from different channels using different 
sensors) or it could be a result of timing differences between channels. 

With "noise" and integrators in the control channels (almost always present 
for reasons of stiffening control loops or providing automatic vehicle trim 
capabilities), the problem will occur even when the loops are closed by a 
common set of vehicle dynamics. 

There are two besic ways of solving this problem. One is to provide 
appropriate channel coupling to stabilize the divergence; the second is to 
suppress data and timing variations between channels. For the Space Shuttle, 
the latter has been chosen. As mentioned, common sensor data are selected 
by Identical algorithms operating on Identical data sets in all GPC's, and 
the GPC’s are sequence-synchronized to prohibit divergence from timing 
variations . 

During noncritical flight phases, mostly on orbit, the flight control is 
operated as an active-standby system, with one GPC in entire control and a 
second available for takeover should the first fall. The effectors on the 
QMS engines are also operated in an active-standby mode. RCS jets are 
operated with somewhat conventional jet-select logic. 

During all flight phases, the fundamental flight control computational 
cycle is 40 milliseconds. A number of flight control computations take 
place only every 80 milliseconds, and some take place approximately once per 
second. In addition to the' basic 40-millisecond minor cycle requirement, 
the total delay between sampling of the flight control sensors and trans- 
mittal of the resulting command to the effectors is constrained to be no 
greater than 20 milliseconds. 
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Software is provided for a number of flight control modes, including 
manual direct (MD) (totally unaugmented) , control stick steering (CSS) 
(significantly augmented) , and automatic (guidance loops closed) . On-orbit 
operations entail many more modes. Details of the digital control laws for 
the multiple flight phases and multiple flight control modes within each 
flight phase cannot be discussed within the space limitations of this paper. 


CONCLUDING REMBKS 


As stated, the Space Shuttle digital fly-by-wire, fllgjit control system 
is a challenge in avionics system design. It is not because of the sophisti- 
cation of the algorithms being Implemented; rather it is because of the 
number of flight phases requiring completely different control algorithms 
and control effectors, the large number of control modes, both manual and 
automatic, and because of the sophisticated and complex techniques required 
for management of redundant systems. It is one of the most interesting 
development programs ever undertaken and because of that is one of the most 
rewarding. 


SYMBOLS 


a angle of attack 

3 sideslip angle 

Y flight path angle 

0 pitch attitude 

0(. pitch attitude command from guidance 

h altitude 

Kt time variable gain 

Ky lateral acceleration gain 

Kg normal acceleration gain 

N„ normal load factor 

Ny lateral load factor 

P roll rate 

q pitch rate 


H-904 
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icr 


dynamic pressure 
q dynamic pressure rate 

r yaw rate 

R range 

t time 

Y cross range 

0 roll attitude 

<f)^ ' roll attitude command from guidance 

-tp heading angle 

heading angle from computer 
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Figure 3. Mated-Ascent Pitch Axis Control 



Figure 4. Mated-Ascent Roll Axis Control 
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Figure 5. 


Mated-Ascent Yaw Axis Control 
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Figure 6. 


Second-Stage Flight Control Mechanization 
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TAEM GEOMETRY 
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Figure 11. Terminal Area Energy Management (TAEM) Guidance System 
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Figure 12. Pitch Axis-Manual Direct 




Figure 15. Pitch Command Augmentation 
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Figure 16. Elevon Summing 



Figure 17. Command Signal Limiting 
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Figure 18. Roll Axis— Computed Air Speed 
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Figure 19 . Yaw Axis— Computed Air Speed 
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Figure 21. Roll Attitude Hold 
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Figure 22. Indicated Air Speed (IAS) Hold 



Figure 23. Pitch Auto-TAEM 
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Figure 24* Microwave Scan Beam Landing System (MSBLS) 
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Figure 25. Autoland Trajectory 
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Figure 26. Flight Control System 



NOTE: ALPHANUMERIC MODIFIER 

DESCRIBES PHYSICAL POSITION 
& FUNCTIONAL REDUNDANCY 


Figure 27. Digital Processing Subsystem Interface 
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Figure 28. Basic Avionics Hardware Configuration for Critical Functions 
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